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CLAIMS 

What is claimed is: 

1 . \A computer-implemented method for analysis of executable program code, the 

2 executaMe program including segments of code that correspond to callable functions in 

3 source coMe from which the executable code was generated, comprising: 

4 readmg from the executable program code pairs of entry points and endpoints, 

5 each pair incHiding an entry point and an endpoint that are associated with a callable 

6 ftinction in the source code and corresponding to a segment of the executable program 

7 code; and \ 

8 generating analysis data for the fimctions identified by the pairs of entry points 

9 and end points. \ 

1 2. The method of claim^L -further comprising scanning the executable program 

2 code for selected characteristicsVusing the pairs of entry points and endpoints. 

1 3. The method of claim 1, further comprising: 

2 executing the program code; \ 

3 detecting execution of the functions using the pairs of entry points and 

4 endpoints; and \ 

5 recording selected execution characteristics^o each executed function. 

1 4. The method of claim 1, wherein the executab^ program code includes one or 

2 more dynamic load modules, the method further comprising: 

3 reading entry points of initializer and deinitializ^\functions from dynamic load 

4 modules; \ 

5 pairing the entry points of the initializer and deinitializer functions with 

6 endpoints of the initializer and deinitializer functions; and \ 

7 generating analysis data for the initializer and de-initializenftmctions identified 

8 by the pairs of entry points and end points of the initializer and deinitiahzer functions. 
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5. The method of claim 4, wherein the executable program code includes a 

2 procedure lookup table (PLT) table associated with the one or more dynamic load 

3 modules^^e method further comprising: 

4 reading function entry points from the PLT; 

5 pairing the entry points from the PLT with endpoints; and 

6 generating analysis data for the PLT functions identified by the pairs of entry 

1 6. The methods^f claim 4, further comprising scanmng the executable program 

2 code for selected characteristics using the pairs of entry points and endpoints. 

1 7. The method of claim 4, further comprising: 

2 executing the program code; 

3 detecting execution of the functions using the pairs of entry points and 

4 endpoints; and \ 

5 recording selected execution characteristics of each executed function. 

1 8. The method of claim 4, wherein the program code includes a symbol table 

2 identifying one or more function entry^points, the method further comprising: 

3 reading entry points of functions, from the symbol table; 

4 pairing the entry points from the symbol table with endpoints; and 

5 generating analysis data for the symbol table functions identified by the pairs of 

6 entry points and end points of the symbol table functions. 

1 9. The method of claim 1, wherein the progtam code includes a symbol table 

2 identifying one or more function entry points, the method further comprising: 

3 reading entry points of functions from the symbol table; 

4 pairing the entry points from the symbol table>with endpoints; and 

5 generating analysis data for the symbol table fictions identified by the pairs of 

6 entry points and end points of the symbol table functionsX 
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^ 1 ThejTiethod^of 1 , further comprising: 

2 detecting functicin-caUs^atjiin^^ 

3 finding the entry point of a runtiJne:idetected function call; 

4 pairing an endpoint with the entry point of ^:Tuntime-detected function call; and 

5 generating analysis data for functions identified^byp^is-o^entry points and end 

6 points of the runtime-detected function calls. 

1 11. The mett^pd of claim 1 0, further comprising: 

2 detecting exi^ution of stub functions at runtime; and 

3 ^ bypassing anal^^si^of stujb functions. 



1 12. The method of claim l^forther comprising: 

2 detecting execution of stuo^functions at runtime; and 

3 bypassing analysis of stub funotions. 

13. Tl^method of claim 10, wherein the executable program code includes one or 

2 more dynamrc^ad modules, the method further comprising: 

3 reading entry points of initializer and deinitializer functions fi-om dynamic load 

4 modules; 

5 pairing the entn^ points of the initializer and deinitializer functions with 

6 endpoints of the initializer and deinitializer functions; and 

7 generating analysis^data for the initializer and de-initializer functions identified 

8 by the pairs of entry points ^d end points of the initializer and deinitializer functions. 

1 14. The method of claim 13^^^^rein the executable program code includes a 

2 procedure lookup table (PLT) table associated with the one or more dynamic load 

3 modules, the method further comprising:\ 

4 reading function entry points fi*om the PLT; 

5 pairing the entry points from the PLT with endpoints; and 

6 generating analysis data for the PLT functions identified by the pairs of entry 

7 points and end points of the PLT functions. \ 
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L5. An apparatus for analysis of executable program code, the executable program 
includihgx§e^nents of code that correspond to callable functions in source code from 
which the executable code was generated, comprising: 

means for reading^Qm^tfie executable program code pairs of entry points and 
endpoints, each pair including an en^^^^omt and an endpoint that are associated with a 
callable function in the source code and corresponding to a segment of the executable 
program code; and 

means for generating analysis data for the functions identified by the pairs of 
entry points and end points. 
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